src: xml: add versioning

Add version to XML chunks in case of future changes.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/chain.c b/src/chain.c
index 4146e6ab88e6472fcf8d282bbfe01cb280e6ffc6..093e3eae1915a933fa371abfde3ed53e5fc67d38 100644 (file)
--- a/src/chain.c
+++ b/src/chain.c
@@ -14,6 +14,7 @@
 #include <endian.h>
 #include <stdint.h>
 #include <stdlib.h>
+#include <limits.h>
 #include <string.h>
 #include <netinet/in.h>
 #include <errno.h>
@@ -469,6 +470,17 @@ static int nft_chain_xml_parse(struct nft_chain *c, char *xml)
        if (tree == NULL)
                return -1;
 
+       /* Validate version */
+       if (mxmlElementGetAttr(tree, "version") == NULL) {
+               mxmlDelete(tree);
+               return -1;
+       }
+       tmp = strtoll(mxmlElementGetAttr(tree, "version"), &endptr, 10);
+       if (tmp == LLONG_MAX || *endptr || tmp != NFT_CHAIN_XML_VERSION) {
+               mxmlDelete(tree);
+               return -1;
+       }
+
        /* Get and set <chain name="xxx" ... >*/
        if (mxmlElementGetAttr(tree, "name") == NULL) {
                mxmlDelete(tree);
@@ -643,7 +655,7 @@ static int nft_chain_snprintf_xml(char *buf, size_t size, struct nft_chain *c)
 {
        return snprintf(buf, size,
                "<chain name=\"%s\" handle=\"%lu\""
-                       " bytes=\"%lu\" packets=\"%lu\">"
+                       " bytes=\"%lu\" packets=\"%lu\" version=\"%d\">"
                        "<properties>"
                                "<type>%s</type>"
                                "<table>%s</table>"
@@ -655,8 +667,8 @@ static int nft_chain_snprintf_xml(char *buf, size_t size, struct nft_chain *c)
                        "</properties>"
                "</chain>",
                        c->name, c->handle, c->bytes, c->packets,
-                       c->type, c->table, c->prio, c->use, c->hooknum,
-                       c->policy, c->family);
+                       NFT_CHAIN_XML_VERSION, c->type, c->table,
+                       c->prio, c->use, c->hooknum, c->policy, c->family);
 }
 
 static int nft_chain_snprintf_default(char *buf, size_t size, struct nft_chain *c)

diff --git a/src/internal.h b/src/internal.h
index b3c3642e10f03fdd41e278d3348b8f4b3c1daae9..3ad5e89e68e28e1e61214cf171665c73f6092875 100644 (file)
--- a/src/internal.h
+++ b/src/internal.h
@@ -17,6 +17,10 @@
 #include <mxml.h>
 #endif
 
+#define NFT_TABLE_XML_VERSION 0
+#define NFT_CHAIN_XML_VERSION 0
+#define NFT_RULE_XML_VERSION 0
+
 struct expr_ops;
 
 struct nft_rule_expr {

diff --git a/src/rule.c b/src/rule.c
index 94eba44f20445ef3ed921b1488f6abfbb99af157..698bf89bd7d4c338f5f2ae7ecb2250cdcac727d9 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -14,6 +14,7 @@
 #include <endian.h>
 #include <stdint.h>
 #include <stdlib.h>
+#include <limits.h>
 #include <string.h>
 #include <netinet/in.h>
 #include <errno.h>
@@ -454,6 +455,17 @@ static int nft_rule_xml_parse(struct nft_rule *r, char *xml)
        if (tree == NULL)
                return -1;
 
+       /* validate XML version <rule ... version=X ... > */
+       if (mxmlElementGetAttr(tree, "version") == NULL) {
+               mxmlDelete(tree);
+               return -1;
+       }
+       tmp = strtoll(mxmlElementGetAttr(tree, "version"), &endptr, 10);
+       if (tmp == LLONG_MAX || *endptr || tmp != NFT_RULE_XML_VERSION) {
+               mxmlDelete(tree);
+               return -1;
+       }
+
        /* get and set <rule ... family=X ... > */
        if (mxmlElementGetAttr(tree, "family") == NULL) {
                mxmlDelete(tree);
@@ -630,9 +642,10 @@ static int nft_rule_snprintf_xml(char *buf, size_t size, struct nft_rule *r,
 
        ret = snprintf(buf, size,
                "<rule family=\"%u\" table=\"%s\" "
-                       "chain=\"%s\" handle=\"%llu\"> ",
+                       "chain=\"%s\" handle=\"%llu\" version=\"%d\"> ",
                                r->family, r->table, r->chain,
-                               (unsigned long long)r->handle);
+                               (unsigned long long)r->handle,
+                               NFT_RULE_XML_VERSION);
        SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
        ret = snprintf(buf+offset, len, "<rule_flags>%u</rule_flags>"

diff --git a/src/table.c b/src/table.c
index 70f482dbe6fd407387d2abaf338eb3a67c73780a..a868da46db4b5305da65a7d7f25e520014546b6a 100644 (file)
--- a/src/table.c
+++ b/src/table.c
@@ -203,6 +203,7 @@ static int nft_table_xml_parse(struct nft_table *t, char *xml)
        mxml_node_t *node = NULL;
        char *endptr = NULL;
        uint64_t tmp;
+       int64_t stmp;
 
        /* NOTE: all XML nodes are mandatory */
 
@@ -211,6 +212,18 @@ static int nft_table_xml_parse(struct nft_table *t, char *xml)
        if (tree == NULL)
                return -1;
 
+       /* Check the version of the XML */
+       if (mxmlElementGetAttr(tree, "version") == NULL) {
+               mxmlDelete(tree);
+               return -1;
+       }
+
+       stmp = strtoll(mxmlElementGetAttr(tree, "version"), &endptr, 10);
+       if (stmp == LLONG_MAX || *endptr || stmp != NFT_TABLE_XML_VERSION) {
+               mxmlDelete(tree);
+               return -1;
+       }
+
        /* Get and set the name of the table */
        if (mxmlElementGetAttr(tree, "name") == NULL) {
                mxmlDelete(tree);
@@ -290,13 +303,14 @@ EXPORT_SYMBOL(nft_table_parse);
 static int nft_table_snprintf_xml(char *buf, size_t size, struct nft_table *t)
 {
        return snprintf(buf, size,
-                       "<table name=\"%s\">"
+                       "<table name=\"%s\" version=\"%d\">"
                                "<properties>"
                                        "<family>%u</family>"
                                        "<table_flags>%d</table_flags>"
                                "</properties>"
                        "</table>" ,
-                       t->name, t->family, t->table_flags);
+                       t->name, NFT_TABLE_XML_VERSION,
+                       t->family, t->table_flags);
 }
 
 static int nft_table_snprintf_default(char *buf, size_t size, struct nft_table *t)